Capture The Flag (CTF) Platform

This project is a Capture The Flag (CTF) platform built using Python and Flask. It includes various challenges such as Cryptography, Web Exploitation, Reverse Engineering, Forensics, and Steganography.

Note

Fully compiled archival version here

Features

User authentication and session management
Multiple CTF challenges
Leaderboard to track team scores
Secure flag submission system
Simple RESTful API

Installation

Clone the repository:

git clone https://github.com/DefinetlyNotAI/Scrapyard_Bounty.git
cd ctf-platform

Create a virtual environment and activate it:

python -m venv venv
source venv/bin/activate  # On Windows use `venv\Scripts\activate`

Install the required packages:
```
pip install -r requirements.txt
```
Modify the scripts environment variables to your secrets

Usage

Run the Flask application:
```
python CTF.py
```
Open your web browser and navigate to http://127.0.0.1:5000.

Challenges

Cryptography: Decrypt a ROT13-encrypted message to uncover the flag.
Web Exploitation: Bypass the login page using SQL Injection to discover the flag.
Reverse Engineering: Analyze a binary file to find a hardcoded key.
Forensics: Analyze a PCAP file in Wireshark to find a hidden key.
Steganography: Extract hidden data from an image file using an automated script.

Contributing

Contributions are welcome! Please fork the repository and submit a pull request.

License

This project is licensed under the MIT License.

API Documentation

This document provides a detailed overview of the available API endpoints for the project. Each endpoint includes information on the HTTP method, URL, required parameters, and whether admin access is required as well as rate limits.

Important

Keep the accept header as "application/json" in the request headers to receive JSON error responses. The API is designed to return HTML responses by priority default if errors occur.

`executeQuery`

URL: /api/executeQuery
Method: POST
Description: Executes a SQL query on the database.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ❌ (Requires an HTTP request with a JSON payload)
Request Body Preview:
```
{
  "query": "SELECT * FROM users"
}
```

Response preview

#200:

{
  "id": 1,
  "username": "example_user",
  "email": "user@example.com"
}

#400:
```
{
  "error": "No query provided"
}
```

#500:

{
  "error": "Query Execution Failed - API execute_query"
}

`api_status`

URL: /api/status
Method: GET
Description: Checks if the API is running and verifies database connectivity.
Admin?: 🔓
Rate Limit: 🚀
Plug and Play?: ✅

Response preview

#200:

{
  "status": "API is running",
  "uptime_seconds": 12345.67,
  "database_connected": true
}

`download_challenge_files`

URL: /api/download/<challenge_id>
Method: GET
Description: Downloads challenge zip files.
Admin?: 🔓
Rate Limit: 🔥 5 requests/hour
Plug and Play?: ✔️ (Browser-accessible if challenge exists, must be signed in)

Response preview

#200 -> (Binary file download)

#404:

{
  "error": "Challenge files not found"
}

#500:

{
  "error": "Failed to fetch challenge files"
}

`backup_db`

URL: /backup/db
Method: GET
Description: Downloads CSV of the DB.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ✅
Response preview
- #200 -> (Binary file download)
- #500:
```
{
  "error": "Error backing up database"
}
```

`get_db_size`

URL: /api/get/size
Method: GET
Description: Fetches the current database size in a human-readable format.
Admin?: 🔓
Rate Limit: 🚀
Plug and Play?: ✅

Response preview

#200:
```
{
  "size": "24 MB"
}
```

#500:

{
  "error": "Failed to get database size"
}

`get_active_connections`

URL: /api/get/activeConnections
Method: GET
Description: Fetches the number of currently active database connections.
Admin?: 🔓
Rate Limit: 🔥 60 requests/hour
Plug and Play?: ✅

Response preview

#200:
```
{
  "activeConnections": 12
}
```

#500:

{
  "error": "Failed to get active connections"
}

`view_teams`

URL: /api/get/allTeams
Method: GET
Description: Fetches all teams with their scores.
Admin?: 🔓
Rate Limit: 🔥 60 requests/hour
Plug and Play?: ✅

Response preview

#200:

[
  {
    "id": 1,
    "team_name": "Team Alpha",
    "score": 150
  },
  {
    "id": 2,
    "team_name": "Team Beta",
    "score": 100
  }
]

#500:

{
  "error": "Failed to get all teams"
}

`get_challenge_progress`

URL: /api/get/challengesProgress
Method: GET
Description: Fetches the progress of challenges for the logged-in team.
Admin?: 🔓
Rate Limit: 🔥 50 requests/hour
Plug and Play?: ✔️ (User must be logged in)

Response preview

#200:

[
  {
    "challenge_id": 1,
    "flag_submitted": true,
    "score": 50
  },
  {
    "challenge_id": 2,
    "flag_submitted": false,
    "score": 0
  }
]

#401:
```
{
  "error": "User not logged in"
}
```

#500:

{
  "error": "An error occurred - Function get_challenge_progress"
}

`get_leaderboard`

URL: /api/get/leaderboard
Method: GET
Description: Retrieves the leaderboard with paginated results.
Admin?: 🔓
Rate Limit: 🔥 30 requests/hour
Plug and Play?: ✅ (Pagination query parameters needed)

Response preview

#200:

[
  {
    "team_name": "Team Alpha",
    "score": 300
  },
  {
    "team_name": "Team Beta",
    "score": 250
  }
]

#500:

{
  "error": "Failed to get leaderboard"
}

I'll continue with the documentation in the same format.

`get_tables`

URL: /api/get/tables
Method: GET
Description: Retrieves a list of all tables in the database.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ✔️ (Admin required)

Response preview

#200:
```
["users", "teams", "challenges"]
```

#500:

{
  "error": "Getting the tables failed"
}

`get_table_rows`

URL: /api/get/tables/<table_name>
Method: GET
Description: Retrieves up to 100 rows from a specific table.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ✔️ (Admin required)

Response preview

#200:

[
  {"id": 1, "username": "admin", "email": "admin@example.com"},
  {"id": 2, "username": "user1", "email": "user1@example.com"}
]

#500:

{
  "error": "Getting the table rows failed"
}

`get_table_schema`

URL: /api/get/tables/<table_name>/schema
Method: GET
Description: Retrieves the schema of a given table.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ✔️ (Admin required)

Response preview

#200:

[
  {"column_name": "id", "data_type": "integer"},
  {"column_name": "username", "data_type": "text"},
  {"column_name": "email", "data_type": "text"}
]

#500:

{
  "error": "Getting the table schema failed"
}

`get_table_headers`

URL: /api/get/tables/headers/<string:table_name>
Method: GET
Description: Retrieves the headers of a given table.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ✔️ (Admin required)

Response preview

#200:
```
[
  "Id",
  "Username",
  "Email"
]
```

#500:

{
  "error": "Getting the table rows headers failed"
}

`delete_table_item`

URL: /api/delete/tables/<table_name>/<row_id>
Method: DELETE
Description: Deletes a specific row from a table based on its ID.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ✔️ (Admin required)

Response preview

#200:

{
  "message": "Item deleted successfully."
}

#500:

{
  "error": "Deleting the table item failed"
}

`delete_table`

URL: /api/delete/tables/<table_name>
Method: DELETE
Description: Deletes an entire table from the database.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ✔️ (Admin required)

Response preview

#200:

{
  "message": "Table deleted successfully."
}

#500:

{
  "error": "Deleting the table failed"
}

`delete_database`

URL: /api/delete/database
Method: POST
Description: Deletes the entire database (users and teams tables).
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ✔️ (Admin required)

Response preview

#200:

{
  "message": "Database deleted successfully."
}

#500:

{
  "error": "Deleting the database failed"
}

`get_user_profile`

URL: /api/get/user/profile
Method: GET
Description: Fetches the logged-in user's profile data.
Admin?: 🔓
Rate Limit: 🔥 100 requests/hour
Plug and Play?: ✔️ (User must be logged in)

Response preview

#200:

{
  "team_name": "Team Alpha",
  "score": 150,
  "flags_submitted": ["flag{example1}", "flag{example2}"]
}

#401:
```
{
  "error": "User not logged in"
}
```
#404:
```
{
  "error": "User not found"
}
```

#500:

{
  "error": "Failed to get user profile"
}

`get_team_rank`

URL: /api/get/user/rank
Method: GET
Description: Fetches the rank of the logged-in team.
Admin?: 🔓
Rate Limit: 🔥 20 requests/hour
Plug and Play?: ✔️ (User must be logged in)

Response preview

#200:

{
  "rank": 3,
  "next_team_score": 250
}

#401:
```
{
  "error": "User not logged in"
}
```
#404:
```
{
  "error": "Team not found"
}
```

#500:

{
  "error": "Failed to get team rank"
}

`get_team_history`

URL: /api/get/user/history
Method: GET
Description: Fetches the history of a logged-in team’s progress.
Admin?: 🔓
Rate Limit: 🔥 50 requests/hour
Plug and Play?: ✔️ (User must be logged in)

Response preview

#200:

[
  {
    "timestamp": "2025-01-30T14:23:00Z",
    "flags_submitted": ["flag{example3}"],
    "score": 50
  },
  {
    "timestamp": "2025-01-29T10:15:00Z",
    "flags_submitted": ["flag{example1}", "flag{example2}"],
    "score": 100
  }
]

#404:

{
  "message": "No history found for the team"
}

#500:

{
  "error": "Failed to get team history"
}

`get_submission_history`

URL: /api/get/user/submissions
Method: GET
Description: Fetches the logged-in team's flag submission history.
Admin?: 🔓
Rate Limit: 🔥 100 requests/hour
Plug and Play?: ✔️ (User must be logged in)

Response preview

#200:

[
  {
    "flag": "flag{example1}",
    "timestamp": "2025-01-30T12:00:00Z"
  },
  {
    "flag": "flag{example2}",
    "timestamp": "2025-01-29T08:45:00Z"
  }
]

#404:

{
  "message": "No submissions found for the team"
}

#500:

{
  "error": "Failed to get submission history"
}

`buy`

URL: /api/shop/buy
Method: POST
Description: Allows a user to buy an item from the shop, generating a receipt image if the item is in stock.
Admin?: 🔓
Rate Limit: 🔥 30 requests/hour
Plug and Play?: ❌ (Proper JSON body must be sent)

Request Body Preview:

{
  "item_id": "123",
  "email": "user@example.com"
}

Response preview
- #200 -> Downloads Receipt:

`update_stock`

URL: /api/shop/update_stock
Method: POST
Description: Allows an admin to update the stock levels for items in the shop.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ❌ (Admin required and Proper JSON body must be sent)

Request Body Preview:

{
  "stock_123": "10",
  "stock_124": "5"
}

`cancel_receipt`

URL: /api/shop/cancel_receipt
Method: POST
Description: Allows an admin to cancel a receipt by deleting it from the database.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ❌ (Admin required and Proper JSON body must be sent)
Request Body Preview:
```
{
  "receipt_id": "abc123"
}
```

`remove_mission`

URL: /api/shop/remove_mission/<int:mission_id>
Method: GET
Description: Allows an admin to remove a mission from the system.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ✔️ (Admin required)

`add_mission`

URL: /api/shop/add_mission
Method: GET, POST
Description: Allows an admin to add a new mission to the system.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ❌ (Proper JSON body must be sent)

Request Body Preview:

{
  "name": "New Mission",
  "description": "A description of the new mission",
  "scraps": "100"
}

`abort_num`

URL: /abort/<http_code>
Method: GET
Description: Allows an admin to trigger an HTTP abort with a specified status code.
Admin?: 🔐
Rate Limit: 🚀
Plug and Play?: ✅

Response:

#200 -> The server aborts with the given HTTP code and a message:

{
  "message": "Requested to abort with code <http_code>"
}

#400:

{
 "message": "Error occurred in /abort"
}

#500:

{
  "message": "Error occurred in /abort"
}

API that require ADMIN

You may add this to the JSON that you are already will send:

{
  "api-key": "API KEY"
}

With the proper API KEY you will be authenticated, This is rate limited to 15 incorrect requests per hour

Mini Table for Emoji Explanation

Emoji	Sector	Meaning
❌	Plug and Play	Impossible to use directly in the browser (requires proper HTTP requests)
✔️	Plug and Play	Requires some setup (like being logged in or an admin) but still browser-accessible
✅	Plug and Play	Fully accessible via browser without any additional setup
🔓	Admin?	No admin required to use the api
🔐	Admin?	Admin is required to use the api
🚀	Rate Limit	No rate limit

Name		Name	Last commit message	Last commit date
Latest commit History 106 Commits
.idea		.idea
src		src
static		static
.gitignore		.gitignore
CTF.py		CTF.py
LICENSE		LICENSE
README.md		README.md
requirements.txt		requirements.txt
vercel.json		vercel.json

License

DefinetlyNotAI/Scrapyard_Bounty

Folders and files

Latest commit

History

Repository files navigation

Capture The Flag (CTF) Platform

Features

Installation

Usage

Challenges

Contributing

License

API Documentation

executeQuery

api_status

download_challenge_files

backup_db

get_db_size

get_active_connections

view_teams

get_challenge_progress

get_leaderboard

get_tables

get_table_rows

get_table_schema

get_table_headers

delete_table_item

delete_table

delete_database

get_user_profile

get_team_rank

get_team_history

get_submission_history

buy

update_stock

cancel_receipt

remove_mission

add_mission

abort_num

API that require ADMIN

Mini Table for Emoji Explanation

About

Topics

Resources

License

Uh oh!

Stars

Watchers

Forks

Uh oh!

Contributors 3

Uh oh!

Languages

`executeQuery`

`api_status`

`download_challenge_files`

`backup_db`

`get_db_size`

`get_active_connections`

`view_teams`

`get_challenge_progress`

`get_leaderboard`

`get_tables`

`get_table_rows`

`get_table_schema`

`get_table_headers`

`delete_table_item`

`delete_table`

`delete_database`

`get_user_profile`

`get_team_rank`

`get_team_history`

`get_submission_history`

`buy`

`update_stock`

`cancel_receipt`

`remove_mission`

`add_mission`

`abort_num`